The Cancer Leadership
Council (CLC) is a forum for education and advocacy among national organizations
concerned with cancer. The CLC, which includes cancer patient organizations,
professional societies, and research organizations, appreciates the opportunity
to offer comments on the March 27, 2002, Notice of Proposed Rulemaking
(NPRM) proposing changes in the Standards for Privacy of Individually
Identifiable Health Information (Privacy Rule).

Background

The cancer community
supports measures that will protect the confidentiality of medical records
without creating obstacles to cancer patients' access to quality care
or constructing barriers to cancer research. We are concerned about disclosures
regarding cancer patients' diagnosis and treatment, but we also want to
ensure that the privacy regulatory system does not impede prompt access
to cancer care. Achieving the appropriate balance between the protection
of individual privacy and other interests, such as a strong biomedical
research effort and speedy access to health care, is not an easy task.
We recognize the efforts of the Department of Health and Human Services
(HHS) to refine the current Privacy Rule.

Consent

For individuals battling
cancer, health care is only quality care if it is provided without delay.
Unfortunately for some cancer patients, postponing the start of treatment
for even a matter of days may have a serious adverse impact on their treatment
outcomes. Delays in access to care pose an unacceptable risk for cancer
patients, and the current Privacy Rule should be modified to ensure that
it does not cause any disruptions in care. Cancer patients are often referred
to an oncologist with special expertise in their cancer by another oncologist
or a primary care physician, or they may independently seek out a specialist.
Treatment - including the receipt and evaluation of medical records, conversations
between the physician and the patient, and development of a preliminary
treatment plan - is often started before the patient sees the specialist
and provides written consent for release of information for treatment.
Cancer patients do not wish to disturb the current system of care in which
their oncologists initiate treatment before the first face-to-face encounter
between patient and oncologist. This system of cancer care works well
by facilitating the efficient delivery of care.

The CLC welcomes HHS
efforts to address the issue of prior consent and its potential to impede
access to quality health care. The Department proposes to replace the
requirement that a health care provider receive consent for disclosure
and use of information prior to treatment with a requirement of a good
faith effort to obtain patients' acknowledgment that they have received
the Notice of Privacy Practices. We believe the proposed modification
addresses potential barriers to access to cancer care without compromising
privacy.

The CLC is aware,
however, that some consumer organizations strongly endorse the retention
of the prior consent and that those organizations recommend instead a
few targeted modifications to address issues related to the implementation
of the prior consent requirement. The cancer community takes a different
view of this matter because of the very nature of cancer. Because cancer
is a life-threatening disease for which treatment must be begun expeditiously,
we endorse a standard that allows more flexibility in the timing of notice
to individuals regarding their privacy rights. If HHS chooses to retain
the prior consent standard, however, the CLC recommends a modification
to allow health care providers to request and receive medical records,
consult with patients over the telephone or through e-mail, and develop
a treatment plan prior to the first in-person contact with the patient
and the receipt of consent.

Health Care Operations

If the final version
of the Privacy Rule does not include a prior consent requirement, that
modification must be accompanied by a more limited definition of health
care operations. In the current version of the Privacy Rule, disclosures
for health care operations would be permitted after a provider obtains
consent for use and disclosure of information. In addition, health care
operations are defined expansively and would permit a number of activities
that go beyond treatment and payment for health care. If patients are
not afforded notice of these potential uses of our health care information
through a prior consent process, we must be guaranteed some protections
by restricting the definition of health care operations.

Marketing

The CLC is troubled
by the proposed modifications in the standards for the use and disclosure
of protected health information (PHI) for marketing activities. Although
HHS has proposed that authorization be required for the use and disclosure
of information for marketing activities, the Department has so narrowly
defined marketing activities that the authorization requirement will have
little effect. HHS proposes to exclude from the definition of marketing
all communications that encourage the use or purchase of a health-related
product or service, even where the covered entity is paid by a third party
to make such a communication.

While the CLC supports
efforts to ensure open and unfettered communication between physicians
and patients regarding treatment options, cancer survivors and their caregivers
believe the proposed modifications upset the balance between open communication
and disclosure of indirect or direct remuneration for marketing activities.

CLC recommends that
HHS leave in place the marketing provisions that are included in the current
Privacy Rule. Under those provisions, a physician or other health care
provider would be allowed to communicate with patients regarding treatment
options or new goods or services but would be required to: 1) disclose
the receipt of remuneration from a third party for those communications;
and 2) provide individuals the opportunity to opt out of receiving future
marketing communications. The cancer community strongly supports the disclosure
of third party payment to providers for their marketing activities. This
disclosure provides the patient important information for informed decision-making.

Medical Research

The CLC acknowledges
the difficulty of balancing the protection of individual privacy and the
smooth functioning of the research enterprise. Cancer patients are highly
motivated to participate in research. We actively seek opportunities to
participate in clinical trials, and we are also willing to deposit our
tissue and data into research databases. However, our willingness to participate
in research is influenced by the assurance that our confidential health
information will be protected. Achieving the proper balance between appropriate
use and disclosure of information and protection against improper breaches
of confidentiality is a challenge.

Cancer advocates are
concerned that certain provisions of the Privacy Rule would slow the speed
of research, including records-based research that may provide important
information about the causes of certain cancers.

The CLC urges the
Department to consider several research-related modifications to the Privacy
Rule:

De-Identification

The Department
has noted the concerns of the research community regarding the standard
for de-identification in the Privacy Rule. Researchers are concerned
that the de-identification standard is so stringent that information
that meets the standard would be useless to researchers. CLC applauds
HHS for its willingness to entertain additional comments on the appropriate
standard for de-identification. The Secretary has identified a set
of direct identifiers that might be removed to achieve de-identification.
CLC recommends the adoption of the standard proposed by HHS.

Public Health
Disclosures

The proposed modifications
would allow covered entities to disclose PHI to private sector registries
that are created for activities related to the quality, safety, or
effectiveness of products regulated by the Food and Drug Administration
(FDA). The Department has noted that there is a great breadth of public
health activities undertaken by sponsors of FDA-approved products
and that those activities should be encouraged by allowing release
of PHI to those registries without authorization.

Regrettably, HHS
does not consider allowing disclosures without authorization to registries
and databases that are maintained by research institutions and non-profit
organizations, even in situations where those registries and databases
have been reviewed and approved by institutional review boards (IRBs).
CLC strongly urges HHS to allow disclosures of PHI without authorization
to registries and databases that are approved by IRBs. If HHS proposes
to allow the release of information without authorization to private
sector registries that are maintained by for-profit entities, the
same standard for data release should be applied to IRB-approved registries
sponsored by non-profit organizations and academic researchers and
institutions. Databases and registries of this sort are critically
important to the cancer research effort and may yield important information
about the causes of cancer and improved treatments for cancer. Their
smooth functioning would be aided by allowing them access to data
on the same basis as sponsors of FDA-regulated products.

Expiration
Date for Authorization Forms

CLC welcomes the
HHS proposal for open-ended authorizations for disclosure of data
to research databases. Researchers had noted the difficulty of establishing
a concrete termination date for an authorization for data disclosure
to research databases, and the proposed modification appropriately
addresses that issue.

The proposal by
HHS still anticipates that separate authorization forms will be necessary
for disclosure of data to a research database and for subsequent uses
of those data for research purposes. This second authorization form
must include an expiration date or event. CLC recommends that HHS
consider a single authorization form for the disclosure of data to
a research database and for subsequent research uses. It is our experience
that cancer patients would be willing to make such authorization to
facilitate research utilizing the data in databases.

We understand
that authorization for subsequent research uses of data in research
databases could be waived through IRB or privacy board review, but
we have concerns that IRBs, already overwhelmed by their workload,
would be unable to complete timely privacy-related reviews of such
proposals.

Conclusion

The CLC is pleased
to have this opportunity to offer suggestions regarding modifications
and refinements to the current Privacy Rule. We appreciate the difficulty
of developing a responsible regulatory scheme to protect medical records
privacy. As cancer patients, caregivers, and researchers, we have seen
the harm that can be done by the inappropriate disclosure of sensitive
medical information. On the other hand, we have also seen the damage that
is caused by unreasonable delays in the provision of health care or in
cancer research. CLC commends HHS for its efforts to achieve an appropriate
balance that is in the best interests of health care consumers.